Research on Quantitative Analysis of System Security Based on Stochastic Petri Net

doi:10.3969/j.issn.1671-1122.2020.09.006

Abstract

Abstract:

In response to the increasing frequency of network attack events, how to accurately and effectively perform experimental inference on the attack events and quantitatively analyze the corresponding indicators of network security has become a research hotspot in recent years. This paper discusses the main indicators and solving methods of network system security assessment in conjunction with the needs of network system security assessment. On this basis, the methods and steps of stochastic Petri nets for modeling and analyzing network system security are studied, and the calculation method of network system security indicators is given in conjunction with the Markov property of the model. Finally, the correctness of the model is verified by specific examples. The results show that it is reasonable and effective to use stochastic Petri nets to model and analyze the network system security, which provides new idea for related research on network system security assessment.

Key words: network system security, stochastic Petri net, Markov property, security assessment

CLC Number:

TP309

WU Zenan, TIAN Liqin, CHEN Nan. Research on Quantitative Analysis of System Security Based on Stochastic Petri Net[J]. Netinfo Security, 2020, 20(9): 27-31.

Figures/Tables 8

References 12

[1]	WU Chensi, XIE Weiqiang, JI Yixiao, et al. Summary of Network System Security Measurement[J]. Journal on Communications, 2019,40(6):14-31.
	吴晨思, 谢卫强, 姬逸潇, 等. 网络系统安全度量综述[J]. 通信学报, 2019,40(6):14-31.
[2]	GONG Jian, ZANG Xiaodong, SU Qi, et al. Summary of Cyber Security Situational Awareness[J]. Journal of Software, 2017,28(4):1010-1026.
	龚俭, 臧小东, 苏琪, 等. 网络安全态势感知综述[J]. 软件学报, 2017,28(4):1010-1026.
[3]	TIAN Jianwei, TIAN Zheng, QI Wenhui, et al. Quantitative Assessment Method of Multi-node Network Security Sitsuation Based on Threat Propagation[J]. Journal of Computer Research and Development, 2017,54(4):731-741.
	田建伟, 田峥, 漆文辉, 等. 基于威胁传播的多节点网络安全态势量化评估方法[J]. 计算机研究与发展, 2017,54(4):731-741.
[4]	WEN Zhicheng, CHEN Zhigang, TANG Jun. Quantitative Assessment Method of Network Security Situation Based on Information Fusion[J]. Journal of Beijing University of Aeronautics and Astronautics, 2016,42(8):1593-1602.
	文志诚, 陈志刚, 唐军. 基于信息融合的网络安全态势量化评估方法[J]. 北京航空航天大学学报, 2016,42(8):1593-1602.
[5]	ZHANG Lei, CUI Yong, LIU Jing, et al. Application of Machine Learning in Cyberspace Security Research[J]. Chinese Journal of Computers, 2018,41(9):1943-1975.
	张蕾, 崔勇, 刘静, 等. 机器学习在网络空间安全研究中的应用[J]. 计算机学报, 2018,41(9):1943-1975.
[6]	XI Rongrong, YUN Xiaochun, ZHANG Yongzheng, et al. An Improved Quantitative Eevaluation Method of Network System Security Situation[J]. Chinese Journal of Computers, 2015,38(4):749-758.
	席荣荣, 云晓春, 张永铮, 等. 一种改进的网络系统安全态势量化评估方法[J]. 计算机学报, 2015,38(4):749-758.
[7]	MADAN B B, KATERINA Goseva-PoPstojanova, Vaidyanathan K, et al. A Method for Modeling and Quantifying the Security Attributes of Intrusion Tolerant Systems[J]. Performance Evaluation, 2004,56(1-4):167-186. doi: 10.1016/j.peva.2003.07.008 URL
[8]	WANG Yuanzhuo, LIN Chuang, CHENG Xueqi, et al. Quantitative Analysis Method of Network Attack and Defense Based on Random Game Model[J]. Chinese Journal of Computers, 2010,33(9):1748-1762. doi: 10.3724/SP.J.1016.2010.01748 URL
	王元卓, 林闯, 程学旗, 等. 基于随机博弈模型的网络攻防量化分析方法[J]. 计算机学报, 2010,33(9):1748-1762.
[9]	JIANG Wei, FANG Binxing, TIAN Zhihong, et al. Research on the Selection of Defense Strategy Based on Offensive and Defensive Random Game Model[J]. Journal of Computer Research and Development, 2010,47(10):1714-1723.
	姜伟, 方滨兴, 田志宏, 等. 基于攻防随机博弈模型的防御策略选取研究[J]. 计算机研究与发展, 2010,47(10):1714-1723.
[10]	PETERSON J. Petri Net Theory and Modeling of Systems[M]. Englewood Ciffs: Prentichall, 1981.
[11]	LIN Chuang. Stochastic Petri Nets and System Performance Evaluation[M]. Beijing: Tsinghua University Press, 2000.
	林闯. 随机Petri网和系统性能评价[M]. 北京: 清华大学出版社, 2000.
[12]	MOLLOY M K. Performance Analysis Using Stochastic Petri Nets[J]. IEEE Transactions on Computers, 1982,31(9):913-917.

位置集	含义
${{p}_{0}}$	系统初始状态,恶意用户准备进行sadmind漏洞扫描
${{p}_{1}}$	恶意用户完成sadmind漏洞扫描并开始向主机Bob发动缓冲区溢出攻击
${{p}_{2}}$	恶意用户完成攻击并取得主机Bob的root权限,准备向主机Bob安装木马程序
${{p}_{3}}$	恶意用户完成对主机Bob木马程序的安装并成功入侵主机,开始对Web服务器进行DDoS攻击
${{p}_{4}}$	系统瘫痪

时间变迁集	含义
${{t}_{t0}}$	sadmind漏洞扫描,速率为${{\lambda }_{0}}$
${{t}_{t1}}$	系统修复,速率为${{\lambda }_{1}}$
${{t}_{t2}}$	缓冲区溢出攻击,速率为${{\lambda }_{2}}$
${{t}_{t3}}$	系统修复,速率为${{\lambda }_{3}}$
${{t}_{t4}}$	安装木马程序,速率为${{\lambda }_{4}}$
${{t}_{t5}}$	系统修复,速率为${{\lambda }_{5}}$
${{t}_{t6}}$	对系统的Web服务器进行攻击,速率为${{\lambda }_{6}}$
${{t}_{t7}}$	系统修复,速率为${{\lambda }_{7}}$

位置集	攻击源	攻击目标	攻击手段	具备的权限	攻击结果
${{p}_{0}}$	恶意用户	系统数据	漏洞查询	匿名	—
${{p}_{1}}$	恶意用户	Bob的主机	sadmind 攻击	匿名	IP地址被扫描
${{p}_{2}}$	恶意用户	Bob的主机	安装木马程序	管理员	获取root 权限
${{p}_{3}}$	Bob的主机	Web 服务器	DDoS 攻击	匿名	控制主机
${{p}_{4}}$	—	—	—	—	系统瘫痪

	${{\lambda }_{0}}$	${{\lambda }_{2}}$	${{\lambda }_{4}}$	${{\lambda }_{6}}$	${{\lambda }_{1}}$	${{\lambda }_{3}}$	${{\lambda }_{5}}$	${{\lambda }_{7}}$	${{A}_{\text{reliablitty}}}$	${{A}_{\text{usability}}}$	${{A}_{\text{fragility}}}$
1	1	1	4	6	1	2	3	3	0.0833	0.59016	0.6944
2	1	1	1	2	1	2	3	3	0.2	0.58065	0.7222
3	1	1	4	6	2	4	6	6	0.0833	0.71287	0.4028
4	0.5	0.5	2	3	0.5	1	1.5	1.5	0.1667	0.59016	1.3889
5	2	2	8	12	2	4	6	6	0.0417	0.59016	0.3472